The vulnerability arises from improper input validation (CWE-20) in the openapi-to-java-records-mustache-templates-parent project. The parent POM file uses the maven-dependency-plugin to unpack .mustache files from the openapi-to-java-records-mustache-templates artifact without sufficient security controls. If the artifact is compromised to include malicious .mustache files, these files would be unpacked automatically during dependency updates, potentially leading to unintended code execution or other impacts. The parent POM is published but not intended for external use, and the vulnerability is fixed in version 3.5.1 of the parent POM.

The impact is limited due to the low CVSS score (2.3) and the fact that the parent POM is not intended for production or external use. The main risk is that if the openapi-to-java-records-mustache-templates artifact is compromised, malicious .mustache files could be unpacked automatically, potentially leading to security issues during build or dependency update processes. There are no known exploits in the wild.

A fix is available in version 3.5.1 of openapi-to-java-records-mustache-templates-parent. It is strongly recommended not to use the parent POM for external or production purposes. Users should upgrade to version 3.5.1 or later to address this vulnerability. Since the parent POM is primarily for testing and maintainability, avoiding its use in production environments mitigates the risk.